nukebase 0.0.1 → 2.0.0

package/lib/login.js

@@ -0,0 +1,167 @@
+// The ways `nukebase login` gets a CLI token. Each returns
+// { uid, token, label } for credentials.put().
+//
+//   browser     open /cli-auth.html, approve, a one-time code comes back to a
+//               local server, swapped (with a PKCE secret) for the token
+//   device      a short code to type on the website, for SSH / no browser
+//   emailLink   the email sign-in link, delivered back to a local server
+//   password    username + password (the master account)
+//
+// The last two get an ordinary session first and swap it at /cli/exchange,
+// which also signs that session out.
+
+const http = require('http');
+const os = require('os');
+const crypto = require('crypto');
+const { openBrowser, hostOf } = require('./ui');
+
+const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+
+const deviceName = () => os.hostname() || 'Unknown device';
+const b64url = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+
+function page(mark, title, message, accent) {
+  return `<!doctype html><meta charset="utf-8"><title>NukeBase</title><body style="font-family:-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;background:#f1f5f9;margin:0;">
+    <div style="max-width:420px;margin:80px auto;background:#fff;border:1px solid #e2e8f0;border-radius:14px;padding:36px;text-align:center;">
+      <div style="font-size:18px;font-weight:800;color:#0f172a;letter-spacing:-0.3px;">&#9670; NukeBase</div>
+      <div style="font-size:40px;margin:16px 0 8px;color:${accent};">${mark}</div>
+      <h1 style="font-size:20px;color:#0f172a;margin:0 0 8px;">${title}</h1>
+      <p style="color:#475569;margin:0;font-size:15px;">${message}</p>
+    </div></body>`;
+}
+
+// A one-shot server on 127.0.0.1 for the browser to come back to. Resolves
+// with the callback's query once one arrives carrying the right state.
+function startLoopback(state) {
+  return new Promise((resolveStart, rejectStart) => {
+    let finish;
+    const result = new Promise((res, rej) => { finish = { res, rej }; });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, 'http://127.0.0.1');
+      if (url.pathname !== '/callback') { res.writeHead(404); return res.end(); }
+      const q = Object.fromEntries(url.searchParams);
+      if (q.state !== state) {
+        res.writeHead(400, { 'Content-Type': 'text/html; charset=utf-8' });
+        return res.end(page('✕', 'Sign-in error', 'This sign-in could not be verified. Return to your terminal and try again.', '#dc2626'));
+      }
+      const denied = q.error === 'access_denied';
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(denied
+        ? page('✕', 'Cancelled', 'The CLI was not signed in. You can close this tab.', '#64748b')
+        : page('✓', 'CLI signed in', 'You can close this tab and return to your terminal.', '#16a34a'));
+      clearTimeout(timer);
+      server.close();
+      finish.res(q);
+    });
+    const timer = setTimeout(() => { server.close(); finish.rej(new Error('No response within 5 minutes. Run nukebase login again.')); }, LOGIN_TIMEOUT_MS);
+    server.on('error', rejectStart);
+    server.listen(0, '127.0.0.1', () => resolveStart({ port: server.address().port, result }));
+  });
+}
+
+async function postJson(url, body, cookie) {
+  const headers = { 'Content-Type': 'application/json' };
+  if (cookie) headers.Cookie = cookie;
+  let res;
+  try {
+    res = await fetch(url, { method: 'POST', headers, body: JSON.stringify(body || {}) });
+  } catch (e) {
+    throw new Error(`Could not reach ${hostOf(url)} (${e.cause?.message || e.message})`);
+  }
+  let data = {};
+  try { data = await res.json(); } catch {}
+  return { status: res.status, ok: res.ok, data };
+}
+
+// A server from before CLI sign-in answers 404 (or the static 404 page).
+function needsNewerServer(r, api) {
+  if (r.status === 404 && !r.data.error) {
+    throw new Error(`${hostOf(api)} doesn't support CLI sign-in yet. Try again after it's updated.`);
+  }
+}
+
+async function browser(api, { email } = {}) {
+  const state = b64url(crypto.randomBytes(24));
+  const verifier = b64url(crypto.randomBytes(32));
+  const challenge = b64url(crypto.createHash('sha256').update(verifier).digest());
+  const { port, result } = await startLoopback(state);
+
+  const url = new URL(`${api}/cli-auth.html`);
+  url.searchParams.set('port', String(port));
+  url.searchParams.set('state', state);
+  url.searchParams.set('challenge', challenge);
+  url.searchParams.set('device', deviceName());
+  if (email) url.searchParams.set('email', email);
+
+  console.log('\n  Opening your browser to approve this CLI. If it doesn\'t open, visit:');
+  console.log(`  ${url}\n`);
+  console.log('  Waiting for approval…  (Ctrl+C to cancel)');
+  openBrowser(url.toString());
+
+  const q = await result;
+  if (q.error) throw new Error('Sign-in was cancelled in the browser.');
+  if (!q.code) throw new Error('The browser did not return a sign-in code.');
+  const r = await postJson(`${api}/cli/token`, { code: q.code, verifier });
+  needsNewerServer(r, api);
+  if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+  return r.data;
+}
+
+async function device(api) {
+  const start = await postJson(`${api}/cli/device-start`, { device: deviceName() });
+  needsNewerServer(start, api);
+  if (!start.ok) throw new Error(start.data.error || `Could not start sign-in (${start.status})`);
+  const { deviceCode, userCode, verifyUrl, interval = 5, expiresIn = 600 } = start.data;
+
+  console.log('\n  On any device, open:');
+  console.log(`    ${verifyUrl}`);
+  console.log('  and enter this code:\n');
+  console.log(`    ${userCode}\n`);
+  console.log(`  Waiting for approval…  (expires in ${Math.round(expiresIn / 60)} minutes)`);
+
+  let wait = Math.max(interval, 2) * 1000;
+  const deadline = Date.now() + expiresIn * 1000;
+  while (Date.now() < deadline) {
+    await new Promise(r => setTimeout(r, wait));
+    const r = await postJson(`${api}/cli/device-poll`, { deviceCode });
+    if (r.status === 410) throw new Error('The code expired. Run nukebase login --device again.');
+    if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+    if (r.data.status === 'slow_down') { wait += 1000; continue; }
+    if (r.data.status === 'approved') return { uid: r.data.uid, token: r.data.token, label: r.data.label };
+  }
+  throw new Error('The code expired. Run nukebase login --device again.');
+}
+
+// Swap an ordinary session for a CLI token, then sign the session out.
+async function exchange(api, uid, token) {
+  const r = await postJson(`${api}/cli/exchange`, { device: deviceName(), revokeCurrent: true }, `uid=${uid}; token=${token}`);
+  needsNewerServer(r, api);
+  if (r.status === 401) throw new Error('That sign-in is no longer valid.');
+  if (!r.ok) throw new Error(r.data.error || `Sign-in failed (${r.status})`);
+  return r.data;
+}
+
+async function emailLink(api, email) {
+  const state = crypto.randomBytes(16).toString('hex');
+  const { port, result } = await startLoopback(state);
+  const r = await postJson(`${api}/magic-link`, { email, redirectUri: `http://127.0.0.1:${port}/callback`, state });
+  if (r.data.status !== 'Success') throw new Error(r.data.message || 'Could not send the sign-in link.');
+
+  console.log(`\n  ✉  Sign-in link sent to ${email} (if it has a NukeBase account).`);
+  console.log('     Open it in a browser on this computer.');
+  console.log('\n  Waiting for the link to be clicked…  (expires in 5 minutes)');
+  const q = await result;
+  if (!q.uid || !q.token) throw new Error('The sign-in link did not return a session.');
+  return exchange(api, q.uid, q.token);
+}
+
+async function password(api, username, pass) {
+  const r = await postJson(`${api}/login`, { username, password: pass });
+  if (r.data.status !== 'Success' || !r.data.uid || !r.data.token) {
+    throw new Error(r.data.message || 'Sign-in failed');
+  }
+  const out = await exchange(api, r.data.uid, r.data.token);
+  return { ...out, label: out.label || username };
+}
+
+module.exports = { browser, device, emailLink, password, exchange, deviceName };